Privacy policy

rcpt (“we”) helps businesses create and send receipts. This page explains what we collect, why, and your rights under the Nigeria Data Protection Act 2023. rcpt is run from Nigeria, and you can reach us about your data at genrcpt@gmail.com.

What we collect

• Account details: your email address, and your name and profile picture if you sign in with Google.
• Business details you enter: business name, logo, phone, address, social handles, return policy and brand colour.
• Receipts you create: items, amounts, payment method, notes, and your customer's name and phone number if you add them.
• Feedback: the rating a customer leaves on a receipt page. We don't collect who left it.
• Team members: if an owner invites you, the name (and email, if given) they enter, your role, and which receipts you issued. The owner and managers of that business can see this.
• Billing: your plan and payment status. Card and bank details are handled by our payment partner, Bachs, and never reach us.

How we use it

• To run your account and show your receipts, history and dashboard.
• To show a receipt to anyone who has its link or QR code, so it can be verified.
• To send account emails such as sign-up confirmation and password resets.
• To manage your subscription.

We don't sell your data, and we don't use your customers' details for marketing.

Your customers' details

When you add a customer's name or phone number to a receipt, you are responsible for having a good reason to do so (such as completing a sale). We store it only to show it on that receipt.

On the public receipt page that the QR code opens, we hide most of the customer's phone number. If you are a customer and want your details removed from a receipt, ask the business that issued it, or email us and we will pass the request on and follow up.

Fun receipts

The free fun receipt maker at /fun works entirely in your browser. What you type there is never saved on our servers or sent to anyone. We only count that a fun receipt was started, downloaded or shared, and which starter template was used, never the words on it.

Who we share it with

Only the services that make rcpt work:

• Supabase stores the database, sign-in and logos.
• Cloudflare hosts the website.
• Resend sends account emails.
• Bachs processes payments.
• Google handles sign-in, if you choose Google.
• Cloudflare Turnstile checks that sign-ups and logins come from a person, not a bot. It looks at basic browser signals and does not set advertising cookies.
• PostHog (EU servers) helps us understand how the app is used, for example how many people finish setup or share a receipt. We send it actions only, never receipt contents, prices, or your customers' names and numbers.
• Cloudflare Web Analytics counts page visits without cookies and without tracking individuals.
• Google Analytics counts visits and where they come from. It runs without cookies, ad features are switched off, and links to receipts and team invites are never sent.

Some of these services store data outside Nigeria, with safeguards in line with the NDPA.

How long we keep it

Receipts are permanent business records, so we keep them while your account exists. If you delete your account, we delete your business, receipts and logo within 30 days, except where the law requires us to keep them.

Your rights

You can ask to see, correct, export or delete your data, or object to how we use it. Email genrcpt@gmail.com. We'll confirm who you are, then reply as quickly as we can and within 30 days. Exports come as a common file format such as CSV. You can also delete your account yourself in Settings, and you can complain to the Nigeria Data Protection Commission.

Keeping it safe

Everything travels over encrypted connections (HTTPS). Database rules let each account read only its own businesses and receipts, and public receipt pages show only what is printed on the receipt itself.

Age

rcpt is for businesses and for people aged 18 or over. We don't knowingly collect data from children.

Cookies

We only use cookies that rcpt needs to work: they keep you signed in and remember which business you are using. Our analytics (PostHog, Google Analytics and Cloudflare Web Analytics) run without cookies and store nothing on your device, which is why you don't see a cookie banner. We don't use advertising cookies and we don't sell or share data with advertisers.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app.